Data Structure Analysis for Binaries
摘要
Data structure analysis (DSA) is a context- and field-sensitive points-to analysis developed for LLVM. It scales reasonably well to medium-size code with a sufficient precision to produce sound verification results. Our work is motivated by the difficulties encountered when analysing binaries. After compilation to machine-code level, binaries are lacking much of the structural information still present in LLVM code, rendering the core of the DSA approach, the unification of cells, insufficient to support precise verification. To overcome this insufficiency, this work adapts the approach, thereby designing a data structure analysis for binaries, DSAbin. The paper proposes multiple options for the set up of our data structure analysis and compares their effects in an evaluation.